DeltaV Virtualization - emerson.com

1 DeltaV Distributed Control SystemWhitepaperOctober 2014 DeltaV Virtualization High Availability and Disaster RecoveryThis document describes High Availiability and Disaster Recovery features supported by DeltaV Virtual Availability and Disaster Recovery October is a standard practice in many industries and is rapidly being adopted within the manufacturing community as a way to reduce costs, increase productivity, extend system life, and improve overall reliability and system performance. The main concerns that manufacturers have with Virtualization are system complexity and reliability. Manufacturers want their virtualized control platform to be easy to implement and maintain, and as reliable as their traditional control s DeltaV system is the first control system to make Virtualization easy to implement and maintain. Our DeltaV Virtual Studio provides an integrated application environment designed for easy implementation and management of virtual DeltaV systems for both off-line and on-line operation.

2 And starting with DeltaV Virtual Studio , emerson delivers High Availability and Disaster Recovery for unprecendented control system High Availability and Disaster Recovery is ImportantVirtualization is appealing because it enables you to optimize your computer resources. You can run multiple virtual computers ( , virtual machines or VMs) within a single host server , and run multiple host servers in a server cluster using shared network storage. See Figure 1 for an illustration of a typical Virtualization environment. This capability delivers attractive benefits, but it also introduces new risks. What if a host server fails? What if your shared network storage fails? Instead of losing just one workstation, you can lose all of the VMs running in the host or using shared storage. So if you put all your eggs in one basket, how do you protect the basket?Protecting your virtualized control system consists of three basic components:1.

3 Data Backup Protects against data loss due to individual file loss, data corruption, or human error. To be protected, data must be backed up regularly. Having multiple recovery points available guards against data loss that is not detected Image Backup Protects against disaster scenarios where your primary host computer or shared storage fails. Image backup and recovery are often referred to as disaster recovery . To minimize recovery time, images must be captured periodically and a secondary host must be available to restart image Automatic Failover Protects against host system failure by automatically moving virtual machines from a primary host that has failed to a secondary host. This capability is commonly referred to as High Availability and is essential when your virtual machines are 1 Example DeltaV Virtualization SystemHigh Availability and Disaster Recovery October to best protect your control system from computer hardware and software failures can depend on the size of your system, and the critical importance of the applications.

4 This whitepaper explores the different levels of availability provided with DeltaV Virtual Studio to protect your system and insure your required level of of AvailabilityControl systems are a critical component of a manufacturing facility. Their availability is paramount to a plant s performance and profitability. There are several means to protect a control system from downtime caused by data loss or hardware / software failures. This section describes the levels of availability provided for different control Traditional Backup and Recovery SystemsTraditional backup systems provide file and/or image backup for individual workstations or servers. The backup files are created by backup agents that run on the managed computers, and are stored on a separate backup storage server . Individual data files can be restored in the case of data corruption. In the event of a machine failure, backup images can be loaded on a spare recovery machine.

5 Figure 2 illustrates a traditional backup and recovery s Backup and Recovery product for traditional system backup provides an easy-to-use backup system with predefined DeltaV templates and automated installation. DeltaV Backup and Recovery is based on industry-leading Acronis Backup & Recovery software. See DeltaV Backup and Recovery Product Data Sheet for more Traditional Backup with Recovery to Virtual MachineTraditional image backup of workstations and servers can also be recovered to a virtual machine running in a recovery host server . The advantage of this option is multiple workstations can be recovered to the same host computer. You can also use the host computer for running other applications ( , maintenance or engineering stations) so that you no longer have to keep idle spare machines around. Figure 3 illustrates traditional backup with recovery to a virtual 2 Traditional Backup and Recovery SystemHigh Availability and Disaster Recovery October Redundant Application ServersThe DeltaV system provides redundancy for several critical applications including Batch Executive, opc server , Zone Servers, and advanced control modules executing in an Application Station.

6 The standard redundancy configuration is to have two application servers that continuously synchronize over Ethernet. If the primary server fails, the secondary server automatically picks up operations without any application redundant DeltaV applications can be implemented in a virtual environment using two virtual machines in separate host servers. No shared network storage or high availability Virtualization capabilities are required. Figure 4 shows redundant applications running in a pair of virtual application stations in two host 3 Traditional backup with recovery to virtual machineFigure 4 Redundant applications running in virtual Application StationsHigh Availability and Disaster Recovery October Redundant Network Storage and SwitchesShared network storage, such as Storage Area Network devices (SANs), provides the ability to easily move virtual machines between host computers. Shared storage can be configured as part of server failover clusters to allow VMs to be automatically moved and restarted in the case of a host server failure ( , High Availability).

7 However, the more VMs running on a shared network storage device, the more VMs are at risk of downtime in case of SAN failure. To protect against failure, SANs are built with multiple redundant components including: Redundant Disk Drives RAID 10 guarantees uninterrupted data access in the event of a disk drive failure. Redundant Disk Drive Controllers Disk Drive Controllers are responsible for the read / write operations performed on the disks. Redundant controllers ensure there is no single point of failure in the disk IO operations. Redundant Power Power supplies are a common source of failure, therefore redundant, independent power supplies are 5 & 6 illustrate a SAN configuration and redundant storage 5 Virtual Machines running on Storage Area Network (SAN) deviceHigh Availability and Disaster Recovery October network switches are also important for critical applications. Redundant network switches are recommended for the thin client network, storage area network (SAN), host management / domain controller network, and DeltaV system Virtual Machine ReplicationVM Replication is the automatic image copy of the virtual machine across a standard network connection using standard Virtualization hypervisor software.

8 VM Replication is commonly used as a Disaster Recovery (DR) strategy whereby virtual machines can be replicated to a remote server , and quickly restored in the case of primary component failure such as host server , shared network storage, or cluster failure. VM Replication is very attractive for DR because it s included at no extra cost with Windows server 2012 software, and it does not require an expensive SAN example of VM Replication is shown in Figure 7. In this example, there are two host servers and a remote replication server . The replication server is connected to the ACN and thin client network so that the DeltaV workstations can operate on the replication server in case of disaster 6 Redundant components in a Storage Area Network DeviceFigure 7 VM Replication to Remote ServerHigh Availability and Disaster Recovery October VM Replication WorksVM Replication is a standard feature of Windows server 2012 (or Hyper-V server 2012).

9 The Windows VM Replication engine has a module called Change Tracking that captures every write within the virtual machine hard disk files and stores each in a log file. This replication happens at the operating system level for the Virtual Hard Drive (VHD), making it easy and efficient to replicate VMs. The replication using these logs occurs periodically ( , every 5 minutes) and asynchronously through an HTTP or HTTPS connection. All the data that must be replicated to the replication server uses the network module, which optimizes the workload such that it works in slow network connections ( WANs). All you need are two physical servers running Windows server 2012 (or Hyper-V server 2012) and a network connection between them. It does not need any third-party hardware or software server 2012 (and Hyper-V server 2012) also includes other special features that support disaster recovery including support for Failover Testing, synchronized Fail Back capability, and live storage limitation with DeltaV VM Replication is that a manual restart of the replicated virtual machine is required when the primary VM has failed.

10 Although it is relatively easy to restart the VM, it requires administrative privileges that most operators don t have. For critical virtual machines that require an automatic restart, High Availability Clusters are High Availability ClusterFor on-line production control systems, high availability with automatic VM failover capabilities is important to insure maximum uptime. DeltaV Virtual Studio supports automatic failover of virtual machines from a primary host to a secondary host in the event of primary host failure. To take advantage of this capability, a failover cluster must be configured using a storage area network (SAN) device with a host domain controller computer to manage the failover switch. Figure 8 illustrates two host computers with shared storage and automatic failover a host failure occurs, DeltaV Virtual Studio automatically moves the virtual machines that were running on the failed host, to a specified secondary host.